What’s Vulnerable › Vulnerabilities

CVE-2022-22971

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-12 · updated 2026-10-08
• Weakness: CWE-770

Description

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

Affected products

• NetApp Cloud Secure Agent: all versions
• OnCommand Insight: all versions
• Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
• Spring Framework: from 5.2.0 through 5.2.21; from 5.3.0 through 5.3.19
• Spring Framework: from Spring Framework versions 5.3.x prior through 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions

References

• https://security.netapp.com/advisory/ntap-20220616-0003/
• https://tanzu.vmware.com/security/cve-2022-22971
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.netapp.com/advisory/ntap-20220616-0003/
• https://tanzu.vmware.com/security/cve-2022-22971
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2022-22971 or the next vulnerability affects your stack